In general the documentation includes info for older versions. There may be some
cases where a feature is added and doesn't say what version it's in. In any
case, you should have documentation with the version that you installed, and
while some things may change a bit, in general the same files are going to be
there.
David Lang
On Fri, 19 Jun 2015, Andrew Couzens wrote:
David,
Sorry to make you repeat yourself. I originally assumed that looking at the v8 documentation wouldn't be helpful since I'm working with v5.
I found success with the option: $SystemLogSocketIgnoreMsgTimestamp off so
thank you very much for your help.
Andrew
________________________________________
From: [email protected] [[email protected]] on
behalf of David Lang [[email protected]]
Sent: Thursday, June 18, 2015 10:20 PM
To: rsyslog-users
Subject: Re: [rsyslog] rsyslog 5: retaining timestamp provided in message
On Thu, 18 Jun 2015, Andrew Couzens wrote:
<snip>
I'm not sure what the procedure is for local logging, but for what its worth
I've been using syslog-ng 2.1.x which uses the timestamp provided in the
rawmsg which is the behaviour i'm looking to get out of rsyslog.
<snip>
I was hoping the date-rfc3339 tag would format the date found in that section
of the rawmsg but it doesn't appear to work. Perhaps that is only valid with
the %timestamp% macros. Is there any way to get the date converted to the
rfc3339 format?
Please read the documentation page I link to below. The paragraph I quote
explains how the timestamp is ignored by default for messages received via
/dev/log, and the rest of the page includes information on how to turn this off
so that timestamps will not be ignored.
David Lang
well, it's a little hard to tell, but is the time supposed to be provided by the
application when writing to /dev/log? or is it just supposed to be '<pri>
syslogtag: message'?
looking at the documentation:
http://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html
Application-provided timestamps are ignored by default. This is needed, as some
programs (e.g. sshd) log with inconsistent timezone information, what messes up
the local logs (which by default don’t even contain time zone information). This
seems to be consistent with what sysklogd did for the past four years. Alternate
behaviour may be desirable if gateway-like processes send messages via the local
log slot - in this case, it can be enabled via the IgnoreTimestamp and
SysSock.IgnoreTimestamp config directives
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
